Detecting changes in application behavior using anomaly corroboration

Abstract

Unexpected changes in application behavior are detected using time series telemetry in a manner that minimizes the upfront knowledge needed about the time series measurements themselves. A univariate analysis is performed on a set of operational metrics to identify anomalous signals indicative of potential anomalous events. A multivariate analysis is then performed to corroborate anomalous signals across groupings of metrics and to thereby determine that the anomalous signals correspond to an anomalous event. A boundary of the anomalous event is determined and the anomalous event is characterized based on a clustering of previously identified incidents. One or more participating entities are then determined for the anomalous event and a narrative description of the anomalous event is generated and presented to an end user. The narrative description identifies, among other things, the characterization of the anomalous event, a predicted cause of the anomalous event, and the participating entities.

Description

DESCRIPTION OF RELATED ART[0001]The behavior of a computing system or a computing environment can vary over time and can be assessed based on various metrics that characterize aspects of that behavior. In some cases, a computing system may exhibit periodic changes in its behavior that form part of an expected pattern of behavior. For instance, a system may undergo periodic backups during which various operational metrics may change due to activity associated with the backups. As an example, a sharp increase in read activity may be observed during the backups. In other cases, rogue activity such as a ransomware attack may cause various operational metrics to trigger outside their normal ranges.BRIEF DESCRIPTION OF THE DRAWINGS[0002]The present disclosure, in accordance with one or more various embodiments, is described in detail with reference to the following figures. The figures are provided for purposes of illustration only and merely depict typical or example embodiments.[0003]FI...

AI Technical Summary

Benefits of technology

The present patent describes a system and method for detecting and analyzing abnormal behavior in a computing environment. The system uses time series telemetry to collect data on operational metrics and compares it to expected patterns to detect potential anomalous events. The system is designed to be highly flexible and can be applied to new applications and types of telemetry data without requiring extensive training. The technical effect of the patent is to provide a more efficient and effective way to detect and analyze abnormal behavior in computing environments.

Problems solved by technology

In other cases, rogue activity such as a ransomware attack may cause various operational metrics to trigger outside their normal ranges.

Images